{"cve":"CVE-2026-26990","nvd":{"published":"2026-02-20T02:16:54.870","modified":"2026-06-17T10:26:29.930","status":"Analyzed","description":"LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injection vulnerability in address-search.inc.php via the address parameter. When a crafted subnet prefix is supplied, the prefix value is concatenated directly into an SQL query without proper parameter binding, allowing an attacker to manipulate query logic and infer database information through time-based conditional responses. This vulnerability requires authentication and is exploitable by any authenticated user. This issue has been fixedd in version 26.2.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-89"],"references":["https://github.com/librenms/librenms/commit/15429580baba03ed1dd377bada1bde4b7a1175a1","https://github.com/librenms/librenms/pull/18777","https://github.com/librenms/librenms/security/advisories/GHSA-79q9-wc6p-cf92"],"products":["librenms:librenms"],"source":"nvd","synced_at":"2026-10-19T22:23:35.260773158+00:00"},"epss":{"cve":"CVE-2026-26990","score":0.04467,"percentile":0.91447,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}